PT-2014-2347 · Apache+1 · Apache Couchdb+1

Melkote · Publicado 2014-03-18 · Atualizado 2017-08-29 · CVE-2012-5641

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MochiWeb versions prior to 2.4.0 Apache CouchDB versions prior to 1.0.4 Apache CouchDB versions 1.1.x prior to 1.1.2 Apache CouchDB versions 1.2.x prior to 1.2.1

Description A directory traversal issue exists in the partition2 function in mochiweb util.erl in MochiWeb, which is used in Apache CouchDB. This issue allows remote attackers to read arbitrary files by including a .. (dot dot backslash) in the default URI.

Recommendations For MochiWeb versions prior to 2.4.0, update to version 2.4.0 or later. For Apache CouchDB versions prior to 1.0.4, update to version 1.0.4 or later. For Apache CouchDB versions 1.1.x prior to 1.1.2, update to version 1.1.2 or later. For Apache CouchDB versions 1.2.x prior to 1.2.1, update to version 1.2.1 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2012-5641

Produtos afetados

Apache Couchdb

Mochiweb

Referências · 8

• 🔥❌ https://github.com/melkote/mochiweb/commit/ac2bf · Exploit, Deleted
• https://github.com/mochi/mochiweb/issues/92 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5641 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5641 · Nota de Segurança
• http://securityfocus.com/bid/57313 · Nota
• http://secunia.com/advisories/51765 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81240 · Nota
• http://seclists.org/fulldisclosure/2013/Jan/81 · Nota